In a typical 3rd Generation Partnership Project (3GPP) Wi-Fi network setup, a User Equipment (UE), an Access Point (AP), an Access Controller (AC), a Wi-Fi Gateway and an Authentication, Authorization and Accounting (AAA)-Server may belong to different operators and may even be located in different networks (e.g., shared networks). This leads to a basic problem that some network components, e.g. the access network (AP/AC) or the Wi-Fi Gateway may be trusted or untrusted, but the UE has no way of knowing or determining this. Some (trusted) network components may be aware of this, but may have no possibility to inform the UE accordingly. In other words, the network being used, or parts thereof, may be trusted or untrusted. From the network perspective, also intermediate network components like the ones mentioned above, and/or the peer (UE) attempting to connect may be trusted or untrusted.
In order to provide a more secure connection between the UE and the network, authentication between the UE and the network has been proposed. Authentication may be regarded as the process of verifying the identity of an entity.
The Extensible Authentication Protocol (EAP) is an authentication framework frequently used in wireless networks and Point-to-Point connections. It is defined in Request for Comments (RFC) 3748 and was updated by RFC 5247. EAP is currently in wide use. For example, in IEEE 802.11 (Wi-Fi) the Wi-Fi Protected Access (WPA) and WPA2 standards have adopted IEEE 802.1X with five EAP types as the official authentication mechanisms.
The EAP standard has no mandatory requirements on end-to-end data encryption. Thus, any plaintext data transmission between the UE and the AAA-Server is open to man-in-the-middle attacks. This basically leaves the subscriber completely open to data/identity theft.
The RFC 3748 describes a simple lock-step (try one-by-one) auto-negotiation of EAP-Types (methods) to initiate Peer Authentication. Currently, approximately 20 EAP methods are defined. The EAP RFC allows up to 253 “standard” methods. It is possible to support more, vendor specific types. For successful authentication, the UE and the network have to agree on an EAP method, which is supported by both. However, even in case of “only” 20 EAP methods, this can be a lengthy and cumbersome procedure.